Entrust Certificate Services Subscription Agreement

Transcription

1 Entrust Certificate Services Subscription Agreement Attention - read carefully: this Entrust Certificate Services Subscription Agreement ("Agreement") is a legal contract between You (as defined below) and Entrust (as defined below). Before continuing, please carefully read this agreement and the CPS, as amended from time to time, which is incorporated into this Agreement and which collectively contain the terms and conditions under which you are acquiring a limited right to use the Certificate Services. The individual who clicks on the "accept" icon below or submits an application for Certificate Services, represents and warrants: (i) you have the legal authority to bind the Subscriber to the terms and conditions of this Agreement and including the CPS; (ii) Subscriber is legally bound by the terms of this Agreement. If you do not agree to the terms and conditions of this Agreement, click on the "decline" icon below and do not continue the application process. 1. Definitions: In addition to capitalized terms defined elsewhere in this Agreement or the CPS, the following capitalized words will have the meaning set out below: Activation Date means the earliest of the following dates (i) the date that Entrust enables the Certificate Services for Your use if you have purchased Management Services from Entrust; (ii) the date that You are issued one or more Certificate(s) if you have not purchased Management Services from Entrust. Agents means, in the context of (1) EV SSL Certificate(s) and EV Code Signing Certificate(s), the following individuals as defined in the CPS (i) Certificate(s) Requestor(s); (ii) Certificate(s) Approver(s); (iii) Applicant Representative(s); (iv) Confirming Person(s); (v) Legal Practitioner(s); Qualified Auditor(s); (vi) Registered Agent(s); and (vii) Contract Signer; and (2) Entrust SSL Web Server Certificate(s) and Private SSL Certificate(s), Your technical contacts as described in the CPS. In either context, Agent will also include (a) any third party who provides hosting services for You or Your Affiliates ( Web Hosters ), or (b) any organization that digitally signs code on behalf of a Subscriber ( Signing Authority ). The Agents initially appointed by You or Your Affiliates are listed as Exhibit A or as otherwise provided to Entrust during enrollment. Such listing may be modified by You using means established by Entrust from time to time. Application Software Vendor or ASV means a developer of Internet browser software or other software that displays or uses certificates, including but not limited to KDE, Microsoft, Mozilla Corporation, Nokia Corporation, Opera Software ASA, and Red Hat, Inc. Certificate(s) means a digital document that at a minimum: (a) identifies the certification authority issuing it, (b) names or otherwise identifies the Subscriber; (c) contains a public key of a key pair, (d) identifies its operational period, and (e) contains a serial number and is digitally signed by a certification authority. In the context of this Agreement, there are various Certificate(s) Types that may be issued to You by Entrust depending upon the Certificate Services that You have purchased. Certificate Beneficiaries means, collectively, all Application Software Vendors with whom Entrust has entered into a contract to include its root certificate(s) in software distributed by such Application Software Vendors, and all Relying Parties that actually rely on such Certificate during the period when it is Valid. Certificate Services means the specific services that You have purchased (on behalf of Yourself and, if applicable, Your Affiliates) relating to the issuance and revocation of one or more Certificate(s) to You or Your Affiliates under any brand that Entrust may use from time to time. Certificate Services may also include Management Services and Malware Scanning Services. Certificate Services also includes any Certificate(s) issued to You (and, if applicable, Your Affiliates) by any member of the Entrust Group and licensed for use under this Agreement. Entrust reserves the right to modify the Certificate Services in its discretion during the Subscription Term.

2 Certificate(s) Types means the type of Certificate(s) that You are issued as part of Certificate Services. These may include extended validation (EV) multi-domain Certificate(s) ( EV SSL Certificate(s) ), extended validation (EV) code signing Certificate(s) ( EV Code Signing Certificate(s) ), Entrust SSL web server Certificate(s) ( Standard Certificate(s) ), advantage SSL web server Certificate(s) ( Advantage Certificate(s) ), unified communication multi-domain Certificate(s) ( UCC Certificate(s) ), code signing Certificate(s) ( Code Signing Certificate(s) ), document signing certificates ( Document Signing Certificate(s) ), mobile device Certificates ( Device Certificate(s) ), private SSL Certificate(s) ( Private SSL Certificate(s) ) and secure personal certificates and secure enterprise certificates are collectively referred to as Client Certificate(s) ). Standard Certificate(s), Advantage Certificate(s), and UCC Certificate(s) are also collectively referred to as Entrust SSL Web Server Certificate(s). EV SSL Certificate(s) and EV Code Signing Certificate(s) are also collectively referred to as Entrust EV Certificate(s). Any Certificates for Adobe CDS will not be distributed under this Agreement, but rather will be made available under the Subscriber Agreement for Entrust Certificates for Adobe Certified Document Services (CDS), although this Agreement does describe the Management Services that may be made available for such Entrust Certificates for Adobe CDS. Client Certificate Agreement means the most recent version of the Client Certificate Agreement that can be found on the Internet at Contract Signer means the individual who agrees to this Agreement on behalf of, and under the authority of, the Subscriber. CPS means the most recent version of the certification practice statement that is incorporated by reference into this Agreement and the Certificate(s) that You are issued, as may be amended from time to time in accordance with the terms of the CPS. The CPS applicable to a specific Certificate(s) that You are issued in connection with Certificate Services depends on the Certificate(s) Type(s) and can be found on the Internet at or by contacting Entrust. For example, use of EV SSL Certificate(s) and EV Code Signing Certificate(s) is governed by the most recent version of the document titled Certification Practice Statements for Extended Validation (EV) Certificates, use of Entrust SSL Web Server Certificate(s), Code Signing Certificate(s), Document Signing Certificate(s) and Client Certificates is governed by the most recent version of the document titled Certification Practice Statement, and use of Private SSL Certificate(s) is governed by the most recent version of the document titled Certification Practice Statement For Private Trust Certificates. Enterprise means You, Your Agents, and Your Affiliates. Entrust means Entrust, Inc. if You are a resident of the United States; otherwise, Entrust means Entrust Limited. Entrust Group means collectively Entrust Holdings, Inc., its subsidiaries, its licensors (including for the avoidance of any doubt Microsoft), its Resellers, its suppliers, and the directors, officers, employees, agents and independent contractors of any of them. EV Guidelines means; (i) in respect to EV SSL Certificate(s), the most recent version of the CA/Browser Forum Guidelines For The Issuance And Management of Extended Validation Certificates ( EV SSL Guidelines ), and (ii) in respect to EV Code Signing Certificate(s), the most recent version of the CA/Browser Forum Guidelines For The Issuance And Management of Extended Validation Code Signing Certificates ( EV Code Signing Guidelines ). EV Guidelines are posted on the Internet at Governmental Authority means any foreign or domestic national, provincial, state, territorial, or local government authority; quasi-governmental authority; court; government organization; government commission; governmental board, bureau or instrumentality; regulatory, administrative or other agency; or any political or other subdivision, department, or branch of any of the foregoing. Malware Scanning Services means optional daily malware scanning services that are made available with a Certificateand hosted by a third party supplier on behalf of Entrust. Each Entrust

3 SSL Web Server Certificate includes the option to perform limited daily malware scanning for up to 250 pages and blacklist monitoring, for one domain. EV SSL Certificates includes the option to perform limited daily malware scanning for up to 500 pages, blacklist monitoring, and such other ancillary scans for one domain that are documented as part of the services. For greater certainty, Private SSL Certificates do not include Malware Scanning Services. Such Malware Scanning Services are subject to You supplying the information necessary to such third party supplier to perform such services and will be available until the earlier of: (i) the end of the Subscription Term; (ii) revocation of the applicable Certificate corresponding to the domain being scanned; and (iii) Malware Scanning Service discontinuation by Entrust. Entrust reserves the right to alter the features and functionality of the Malware Scanning Services or discontinue such services throughout the Subscription Term and makes no warranty that any malware, security threats or vulnerabilities will be detected or is detectable by such services. Management Services means a self-service administration tool hosted by Entrust that is designed to help You manage Certificate(s) that may be made available to You by Entrust that enables You to manage the issuance, revocation, and expiry of one or more Certificate(s) issued to You as part of Certificate Services. Management Services are available in two (2) deployment and use models as may be described in the documentation: a certificate pooling model ( Pooling ) and a non-pooling model ( Non-Pooling ). Permitted Group means in the case of (i) Entrust SSL Web Server Certificate(s), EV SSL Certificate(s), Private SSL Certificate(s), EV Code Signing Certificate(s), Document Signing Certificate(s) and Code Signing Certificates, You and Your Affiliates; and (ii) in the case of Client Certificates, Your employees or third parties conducting Enterprise related business with to whom You have assigned an address for such business purposes. Person means and includes an individual, corporation, business, trust, partnership, limited liability company, association, joint venture, Governmental Authority, public corporation, or any other legal or commercial entity. Reseller means a legal entity authorized by Entrust to resell Certificate Services to You. Microsoft means Microsoft Corporation, a Washington corporation, with its principal place of business at One Microsoft Way, Redmond, Washington Relying Party means any individual or entity that relies on a Valid Certificate. For avoidance of doubt, an ASV is not a Relying Party when software distributed by such ASV merely displays information regarding a Certificate. Subscriber means the Person in the Permitted Group who is issued a Certificate under this Agreement. Subscription Fees means the fees established by Entrust that You will pay to use the Certificate Services, Management Services and ECS Support Services, as posted from time to time at Entrust s internet web site and/or in the documentation included with the Management Services, or as set out in a quotation issued to You by Entrust, or as set out in a purchase order issued by You to Entrust (or an authorized reseller of Entrust) that has been accepted by Entrust. In spite of the foregoing, if You have purchased the Certificate Services through a Reseller the Subscription Fees will be the fees agreed to between You and such Reseller provided that such Reseller pays to Entrust such portion of such Subscription Fees as required pursuant to the written agreement between Entrust and such Reseller. Subscription Term means the length of time that You have subscribed to purchase Certificate Services commencing on the Activation Date. In the case where You have purchased Certificate Services that: (i) are for a single Certificate, the Subscription Term is the validity period of the applicable Certificate(s); (ii) include Pooling Management Services, the Subscription Term is the period of time for which You have purchased the right to use such Management Services,

4 irrespective of whether the Certificate(s) that are issued to You as part of Certificate Services have validity periods extending beyond such period of time, or (iii) include Non-Pooling Management Services, the Subscription Term is the validity period of the applicable Certificate(s) issued under such Management Services, provided that all such Certificates are issued on or before the one (1) year anniversary of the Activation Date after which time such ability to request issuance shall expire. In the event that You elect to renew your subscription to the Certificate Services upon expiration of the Subscription Term for an additional length of time (a Renewal Term ), the Subscription Term will be extended to include such Renewal Term upon payment of the Subscription Fees for the Renewal Term. In any case, the Subscription Term may be shortened pursuant to Section 7 of this Agreement. You or Your means the Person who has entered into this Agreement to receive Certificate Services. Your Affiliates means Your controlled subsidiaries who You will cause to comply with this Agreement. In this context,you control a subsidiary if You own fifty percent (50%) or more of the voting rights for the board of directors or other mechanism of control for the corporation or other entity. Valid means that a Certificate that has not expired and has not been revoked. 2. Services and License (a) Issuance of Certificate(s): Upon receipt of Your application for Certificate Services, Entrust or a subcontractor acting on behalf of Entrust will perform limited verification (as described in the CPS) of the information submitted by Enterprise. After completing such verification, Entrust may issue You or Your Affiliates (if applicable) one or more Certificate(s) (depending on the amount of Subscription Fees You have paid) as described in the CPS. If Entrust issues Certificate(s) services to You or Your Affiliates (if applicable), Entrust will make such Certificate(s) available for retrieval. (b) Grant of License: Subject to the terms and conditions of this Agreement, Entrust hereby grants to Enterprise a non-exclusive, non-transferable license to use the Certificate Services; provided, however, that Enterprise may only use the Certificate Services (including for the avoidance of any doubt, all Certificate(s)) in compliance with this Agreement and the CPS, for the sole purposes of securing communications pertaining to Enterprise related business. If the Certificate Services include Management Services, Enterprise may only use the Management Services in compliance with this Agreement and the CPS for the purpose of managing Certificate(s) issued by Entrust to You or Your Affiliates. All use of the Management Services must be in accordance with the documentation supplied to You as part of the Management Services. If Entrust makes computer software available to Enterprise for download as part of the Certificate Services, such software will be licensed to Enterprise under the terms of the license agreement embedded in or associated with such software. Enterprise does not acquire any rights, express or implied, in the Certificate Services, other than those rights specified in this Agreement and the CPS. Enterprise will not host, time-share, rent, lease, sell, license, sublicense, assign, distribute or otherwise transfer any component of Certificate Services, except as provided in this Agreement and the CPS. If one or more enabling mechanisms ( License String ) that provides Enterprise with access to the Certificate Services is supplied to Enterprise, Enterprise may only use such Licensing String for the purpose of using the Certificate Services and Enterprise may not copy or alter a Licensing String. Each permitted copy of all or part of any item of Certificate Services must include all copyright notices, restricted rights legends, proprietary markings and the like exactly as they appear on the copy delivered by Entrust to Enterprise. You may only deploy the number of Certificates that You have purchased from Entrust or its Reseller. Enterprise will not copy, modify, adapt or merge copies of the Certificate Services except as provided in this Agreement and the CPS. Enterprise will not translate, reverse engineer, de-compile or

5 disassemble the Certificate Services except to the extent that law explicitly prohibits this restriction notwithstanding a contractual restriction to the contrary. (c) Lifecycle Monitoring Service: Entrust will provide You with a lifecycle monitoring service ("LMS"). The LMS is designed to reduce the chance of disruption of Your service which may be caused by the expiration of Your Certificate(s). Entrust will use commercially reasonable efforts to send an to the technical contact listed in the information provided to Entrust with Your Certificate Services Application (such person referred to as Notice Recipient ). Such will inform the Notice Recipient that Your Certificate(s) is due to expire according to the user configurable parameters set out in the Management Services. In the event that the Notice Recipient changes, You can still receive a LMS notice if You provide Entrust with updated contact information for the Notice Recipient at least sixty (60) days prior to the date that Your Certificate(s) is due to expire. You will not be eligible for the LMS if Your Notice Recipient changes and Entrust is not informed of such change within the time period set forth above. (d) ECS Support Services: If You have purchased Management Services You are entitled to receive the ECS Support Services set below. ECS Support Services means the maintenance, support and verification services relating to the: (i) issuance and revocation of one or more Certificate(s) to You or Your Affiliates, (ii) Certificate Services, and (iii) Management Services, that are provided by Entrust according to the service plan selected and paid (if applicable) for by You. ECS Support Services are available in the following service plans: (i) the Silver Support Plan ( Silver Support ), and (ii) the Platinum Support Plan ( Platinum Support ). ECS Support Services are provided by Entrust for the duration of the Subscription Term pursuant to the terms and conditions of the ECS Support Services Agreement available on the Internet at Entrust reserves the right to modify the ECS Support Services in its discretion during the Subscription Term. 3. Fees If You have subscribed to Management Services, Silver Support services will be provided to You at no additional charge as part of the Management Services that You have subscribed to. If You have subscribed to Management Services, You may elect to upgrade the ECS Support Services to the Platinum Support Plan, subject to Your payment of the applicable Subscription Fee. The Subscription Fee for the Platinum Support Plan must be paid for all Certificates in the Management Services account, or added thereafter during the Subscription Term. You will pay all applicable Subscription Fees for any Certificate Services issued to You, plus any additional taxes. Such payment will be made within thirty (30) days of the receipt of an invoice from Entrust for any such Certificate Services; provided, however that if You have purchased the Certificate Services through a Reseller then the payment terms will be those terms established between You and such Reseller. In the event that You do not pay the applicable fees for any Certificate Services extended to You (or where You have purchased the Certificate Services through a Reseller and such Reseller does not pay Entrust the applicable fees for any Certificate Services in accordance with Entrust s agreement with such Reseller), Enterprise will not be entitled to use such Certificate Services (including for the avoidance of any doubt, any Certificate(s)) and Entrust may refuse to process any subsequent applications submitted by You for additional Certificate Services and revoke all Certificate(s). All amounts due under this Agreement to Entrust must be paid to the invoicing member of the Entrust Group. 4. Representations, Warranties And Additional Obligations You represent and warrant to Entrust and all Certificate Beneficiaries that You have the authority to bind Your Affiliates to this Agreement and the CPS as a Subscriber (if Your Affiliates are issued any Certificate(s) or otherwise receive any Certificate Services in connection with the Management

6 Services purchased hereunder, if applicable). You will and You will cause Your Affiliates who receive any Certificate Services hereunder, and Your Agents, to comply with: (A) the requirements (including but not limited to providing the representations and warranties) set forth in this Agreement, the applicable CPS and, in the case of EV SSL Certificate(s) and EV Code Signing Certificate(s), the EV Guidelines, and (B) all applicable laws including, without limitation, laws relating to import, export, licensing, and data protection, as they apply to the activities contemplated under this Agreement or the right to include personal information in Certificates. You further represent and warrant to Entrust and all Certificate Beneficiaries that: (i) (ii) (iii) (iv) (v) (vi) (vii) (viii) (ix) (x) (xi) in the case of Code Signing Certificates and EV Code Signing Certificates, You will not use the Certificate to digitally sign hostile code, including spyware or other malicious software (malware) that is downloaded without user consent and You acknowledge that Entrust will revoke such Certificate if You fail to comply; all information provided, and all representations made, by Subscriber in relation to any Certificate Services are and will be complete, accurate and truthful (and Subscriber will promptly update such information and representations from time to time as necessary to maintain such completeness and accuracy); the Private Key corresponding to the Public Key submitted to Entrust in connection with Certificate Services Application was created using sound cryptographic techniques and all measures necessary have been taken to maintain sole control of, keep confidential, and properly protect the Private Key (and any associated access information or device e.g., password or token) at all times; any information provided to Entrust or to any independent third-party Registration Authorities in connection with Certificate Services Application does not infringe, misappropriate, dilute, unfairly compete with, or otherwise violate the intellectual property, or other rights of any person, entity, or organization in any jurisdiction; the Certificate(s) will not be installed or used until it has reviewed and verified the accuracy of the data in each Certificate(s); in the case of Entrust SSL Certificates, EV SSL Certificates and Private SSL Certificates, the Certificate(s) will be installed only on the server accessible at the domain name (subjectaltname(s)) listed on the Certificate(s); Certificates will only be used in compliance with all applicable laws, solely for authorized company business, solely in accordance with the Agreement and the CPS and, the Certificate Services will not be used for any hazardous or unlawful (including tortious) activities; You will immediately respond to Entrust s instructions concerning (1) compromise of the Private Key associated with any Certificate, and (2) misuse or suspected misuse of a Certificate; all use of the Certificate and its associated private key will cease immediately, and the Subscriber will promptly notify Entrust and request the revocation of the Certificate, if (1) any information included in the Subscriber s Certificate Services Application or Certificate changes, is or becomes incorrect or inaccurate, or if any change in any circumstances would make the information in the Certificate incorrect, misleading or inaccurate; or (2) there is any actual or suspected misuse or compromise of the Private Key (or key activation data) associated with the Public Key in the Certificate; all use of the (1) Certificate and (2) Private Key associated with the Public Key in such Certificate Services will cease upon expiration or revocation of such Certificate, and such Certificate will be removed from the devices and/or software in which it has been installed; Your Agents are duly authorized and qualified to perform this Agreement on Your behalf, and such Agents will meet the requirements of this Agreement, the applicable

7 (xii) (xiii) (xiv) (xv) CPS and, in the case of EV SSL Certificate(s) and EV Code Signing Certificate(s), the EV Guidelines; the subject named in the Certificate(s) corresponds to the Subscriber, and that the Subscriber has authorized the inclusion of such information in the Certificate; and You have the exclusive right to use the domain name or address listed in Certificate; in respect to EV Code Signing Certificates; (1) You will only digitally sign code that complies with the requirements set forth in the EV Code Signing Guidelines, (2) in the event that there is evidence that the EV Code Signing Certificate was used to digitally sign hostile code, including spyware or other malicious software (malware) downloaded without user consent, or the code has a serious vulnerability; (A) all use of the EV Code Signing Certificate and its associated private key will cease immediately, and (B) You will immediately notify Entrust and request the revocation of the EV Code Signing Certificate if You become aware (by whatever means) that Enterprise has digitally signed code that contains hostile code, including spyware or other malicious software (malware) that is downloaded without user consent, (3) You acknowledge that ASV s may independently determine that an EV Code Signing Certificate is malicious or compromised and that ASV s and ASV s products may have the ability to modify its customer experiences or blacklist an EV Code Signing Certificate without notice to You or Entrust and without regard to the revocation status of the EV Code Signing Certificate, (4) You will, as a best practice, timestamp the digital signature after digitally signing Your code, (5) You acknowledge that (a) Entrust will not provide EV Code Signing Certificates with signing keys that are less than 2048 bits, and (b) You will provide SHA-2 as an option for the hashing algorithm; in respect to Document Signing Certificates, You will generate and protect the Key Pair in a cryptographic module that (a) prevents exportation or duplication, and (ii) meets or exceeds FIPS Level 2 certification standards. You expressly agree that You will: a) understand and, if necessary, receive proper education in the use of Public-Key cryptography and Certificate(s) including Certificate Services; b) provide, in any communications with Entrust or an independent third-party Registration Authority, correct information with no errors, misrepresentations, or omissions; c) generate a new, secure, and cryptographically sound Key Pair to be used in association with the Certificate or Subscriber s Certificate Services Application; d) read and agree to all terms and conditions of the CPS; e) refrain from modifying the contents of Certificates; f) use Certificates and Certificate Services exclusively for legal and authorized purposes in accordance with the terms and conditions of the CPS and applicable laws; g) only use Certificates on behalf of the organization listed as the Subject in such Certificates; h) keep confidential and properly protect the Private Keys; i) notify Entrust as soon as reasonably practicable of any change to any information included in the Subscriber s Certificate Services Application or any change in any circumstances that would make the information in the Subscriber s Certificate Services Application misleading or inaccurate; j) notify Entrust as soon as reasonably practicable of any change to any information included in the Certificate or any change in any circumstances that would make the information in the Certificate misleading or inaccurate; k) immediately cease to use Certificates if any information included in the Certificate or if any change in any circumstances would make the information in the Certificate misleading or inaccurate; l) notify Entrust immediately of any suspected or actual Compromise of the Private Keys and request the revocation of such Certificate;

8 m) immediately cease to use the Certificate upon (a) expiration or revocation of such Certificate, or (b) any suspected or actual Compromise of the Private Key corresponding to the Public Key in such Certificate, and remove such Certificate from the devices and/or software in which it has been installed; n) will comply with all applicable laws including, without limitation, laws relating to import, export, licensing, and data protection, as they apply to the activities contemplated under this Agreement including without limitation Enterprise s right to export, import or use the Certificate Services or the right to include personal information in Certificates; o) refrain from using the Private Key corresponding to the Public Key in the Certificate to sign other Certificate(s); and p) use appropriate judgment about whether it is appropriate, given the level of security and trust provided by Certificate, to use Certificate in any given circumstance. For the avoidance of any doubt, (1) Entrust will not be under any obligation to issue any Certificate containing pre-qualified information if such pre-qualified information is subsequently found to have changed or to be in any way inaccurate, incorrect, or misleading; (2) by submitting a request for Certificate, You are representing and warranting that the pre-qualified information has not changed and is in no way inaccurate, incorrect, or misleading; (3) Entrust shall be entitled to revoke a Certificate issued to You if (i) the pre-qualified information submitted by You is subsequently found to have changed or to be inaccurate, incorrect, or misleading, (ii) if revocation is requested by You, (iii) upon expiry or termination of this Agreement, or (iv) for any other reason identified for revocation in the CPS or the applicable EV Guidelines; (4) You must notify Entrust immediately of any change to any information included in any Certificate issued to You or any Certificate management service application submitted by You or any change circumstances that would make the information in any such Certificate or Certificate Management Service application inaccurate, incorrect, or misleading, and (5) You must notify Entrust immediately of any changes to pre-qualified information, or any changes in any circumstances that would make any pre-qualified information inaccurate, incorrect, or misleading. Client Certificates and Mobile Device Certificates may be issued and distributed to third parties within the Permitted Group, provided that such issuance and distribution is done pursuant to the Client Certificate Agreement and provided that (i) You have independently verified the information included in each Client Certificate as being accurate; (ii) the individual to whom such Client Certificate is issued has consented to the inclusion of all data that is incorporated into such Client Certificates; (iii) You have paid the applicable license fee for the Client Certificate; and (iv) such Client Certificate is used for Enterprise related business only. 5. Confidentiality You acknowledge that the Certificate Services (and any information incorporated therein or provided thereto) contain the confidential information of Entrust. You will not translate, reverse engineer, de-compile, disassemble, or develop competitive Certificate Services using any such information derived from Entrust s confidential information. You will retain Entrust s confidential information in confidence and will use, disclose, and copy it solely for the purpose of, and in accordance with the Agreement. You will only disclose Entrust s confidential information to Your employees and Enterprise employees with a need to know. You will use the same degree of care as You use to protect Your own confidential information of a similar nature, but no less than reasonable care, to prevent the unauthorized use or disclosure of Entrust s confidential information. You will not be bound by any obligations restricting disclosure and use set forth in this Agreement with respect to Entrust s confidential information, or any part thereof, which: (i) was known to You prior to disclosure, without any obligation of confidentiality; (ii) was lawfully in the public domain prior to its disclosure, or becomes publicly available other than through a breach of this Agreement; (iii) was disclosed to You by a third party, provided that such third party is not in breach of any confidentiality obligation in respect of such information; or (iv) is independently developed by You.

9 If You are compelled pursuant to legal, judicial, or administrative proceedings, or otherwise required by law, to disclose the confidential information of Entrust, You will use reasonable efforts to seek confidential treatment for such confidential information, and provide prior notice to Entrust to allow Entrust to seek protective or other court orders. 6. Intellectual Property Ownership The Certificate Services and all modifications, enhancements and derivative works thereof, including all right, title and interest (and all intellectual proprietary rights therein) remain the sole and exclusive property of Entrust and/or its third-party licensors. 7. DISCLAIMER OF WARRANTY EXCEPT FOR THE EXPLICIT REPRESENTATIONS, WARRANTIES, AND CONDITIONS PROVIDED IN THIS AGREEMENT AND THE CPS, CERTIFICATE SERVICES AND ANY SERVICES PROVIDED IN RESPECT TO CERTIFICATE(s) ARE PROVIDED "AS IS", AND NEITHER ENTRUST GROUP NOR ANY INDEPENDENT THIRD-PARTY REGISTRATION AUTHORITIES OPERATING UNDER THE ENTRUST CERTIFICATION AUTHORITIES, NOR ANY RESELLERS, CO-MARKETERS, OR ANY SUBCONTRACTORS, DISTRIBUTORS, AGENTS, SUPPLIERS, EMPLOYEES, OR DIRECTORS OF ANY OF THE FOREGOING MAKE ANY REPRESENTATIONS OR GIVE ANY WARRANTIES, OR CONDITIONS, WHETHER EXPRESS, IMPLIED, STATUTORY, BY USAGE OF TRADE, OR OTHERWISE, AND ENTRUST GROUP, ALL INDEPENDENT THIRD-PARTY REGISTRATION AUTHORITIES OPERATING UNDER THE ENTRUST CERTIFICATION AUTHORITIES, ALL RESELLERS OR CO- MARKETERS, AND ANY SUBCONTRACTORS, DISTRIBUTORS, AGENTS, SUPPLIERS, EMPLOYEES, OR DIRECTORS OF ANY OF THE FOREGOING SPECIFICALLY DISCLAIM ANY AND ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS OF MERCHANTABILITY, NON-INFRINGEMENT, TITLE, SATISFACTORY QUALITY, OR FITNESS FOR A PARTICULAR PURPOSE. EXCEPT FOR THE EXPLICIT REPRESENTATIONS, WARRANTIES AND CONDITIONS CONTAINED IN THIS AGREEMENT AND IN THE CPS, THE ENTIRE RISK OF THE USE OF ANY CERTIFICATE SERVICES OR ANY SERVICES PROVIDED IN RESPECT CERTIFICATE SERVICES OR THE VALIDATION OF DIGITAL SIGNATURES WILL BE BORNE SOLELY BY YOU. 8. LIMITATION OF LIABILITY IN NO EVENT WILL THE TOTAL CUMULATIVE LIABILITY OF ENTRUST GROUP, ANY INDEPENDENT THIRD-PARTY REGISTRATION AUTHORITY OPERATING UNDER AN ENTRUST CERTIFICATION AUTHORITY, ANY RESELLERS, OR CO-MARKETERS, OR ANY SUBCONTRACTORS, DISTRIBUTORS, AGENTS, SUPPLIERS, EMPLOYEES, OR DIRECTORS OF ANY OF THE FOREGOING TO ANY SUBSCRIBER, RELYING PARTY OR ANY OTHER PERSON, ENTITY, OR ORGANIZATION ARISING OUT OF OR RELATING TO ANY CERTIFICATES, CERTIFICATE SERVICES OR ANY SERVICES OR SOFTWARE PROVIDED IN RESPECT TO CERTIFICATE SERVICES, INCLUDING ANY USE OR RELIANCE ON ANY CERTIFICATE SERVICES, EXCEED THE GREATER OF (1) ONE THOUSAND UNITED STATES DOLLARS ($1, U.S.); AND (2) TWO TIMES THE FEES PAID BY YOU TO ENTRUST UNDER THIS AGREEMENT DURING THE TWELVE MONTHS PRIOR TO THE INITIATION OF THE CLAIM TO A MAXIMUM OF ONE HUNDRED THOUSAND DOLLARS ($100,000.00) (SUCH GREATER NUMBER REFERRED TO AS THE CUMULATIVE DAMAGE CAP ). SUBJECT TO THE FOREGOING, IN THE EVENT OF ANY CLAIM(S) MADE BY SUBSCRIBER AND/OR RELYING PARTIES ARISING FROM THE USE OF AN ENTRUST EV CERTIFICATE, THE CUMULATIVE DAMAGE CAP WITH RESPECT TO SUCH CLAIM(S) WILL NOT BE LESS THAN TWO THOUSAND UNITED STATES DOLLARS ($2, U.S.) PER ENTRUST EV CERTIFICATE ON A CUMULATIVE BASIS FOR ALL SUCH CLAIMS MADE BY SUBSCRIBER AND ALL RELYING PARTIES. THE FOREGOING LIMITATIONS WILL APPLY TO ANY LIABILITY WHETHER BASED IN CONTRACT (INCLUDING FUNDAMENTAL BREACH), TORT (INCLUDING NEGLIGENCE), LEGISLATION OR ANY OTHER THEORY OF

10 LIABILITY, INCLUDING ANY DIRECT, INDIRECT, SPECIAL, STATUTORY, PUNITIVE, EXEMPLARY, CONSEQUENTIAL, RELIANCE, OR INCIDENTAL DAMAGES. IN NO EVENT WILL ENTRUST GROUP OR ANY INDEPENDENT THIRD-PARTY REGISTRATION AUTHORITY OPERATING UNDER AN ENTRUST CERTIFICATION AUTHORITY, OR ANY RESELLERS, CO-MARKETERS, OR ANY SUBCONTRACTORS, DISTRIBUTORS, AGENTS, SUPPLIERS, EMPLOYEES, OR DIRECTORS OF ANY OF THE FOREGOING BE LIABLE FOR ANY INCIDENTAL, SPECIAL, STATUTORY, PUNITIVE, EXEMPLARY, INDIRECT, RELIANCE, OR CONSEQUENTIAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS, LOSS OF BUSINESS OPPORTUNITIES, LOSS OF GOODWILL, LOSS OF PROFITS, BUSINESS INTERRUPTION, LOSS OF DATA, LOST SAVINGS OR OTHER SIMILAR PECUNIARY LOSS) WHETHER ARISING FROM CONTRACT (INCLUDING FUNDAMENTAL BREACH), TORT (INCLUDING NEGLIGENCE), LEGISLATION OR ANY OTHER THEORY OF LIABILITY. THE FOREGOING LIMITATIONS WILL APPLY NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY STATED HEREIN AND EVEN IF ENTRUST GROUP OR ANY INDEPENDENT THIRD-PARTY REGISTRATION AUTHORITY OPERATING UNDER AN ENTRUST CERTIFICATION AUTHORITY, OR ANY RESELLERS, CO- MARKETERS, OR ANY SUBCONTRACTORS, DISTRIBUTORS, AGENTS, SUPPLIERS, EMPLOYEES, OR DIRECTORS OF ANY OF THE FOREGOING HAVE BEEN ADVISED OF THE POSSIBILITY OF THOSE DAMAGES. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, SO THESE LIMITATIONS SET FORTH ABOVE MAY NOT APPLY TO CERTAIN SUBSCRIBERS, RELYING PARTIES, OR OTHER PERSONS, ENTITIES, OR ORGANIZATIONS. THE DISCLAIMERS OF REPRESENTATIONS, WARRANTIES, AND CONDITIONS AND THE LIMITATIONS OF LIABILITY IN THIS AGREEMEMT CONSTITUTE AN ESSENTIAL PART OF THIS AGREEMENT. ALL SUBSCRIBERS, RELYING PARTIES, AND OTHER PERSONS, ENTITIES, AND ORGANIZATIONS ACKNOWLEDGE THAT BUT FOR THESE DISCLAIMERS OF REPRESENTATIONS, WARRANTIES, AND CONDITIONS AND LIMITATIONS OF LIABILITY, ENTRUST WOULD NOT ISSUE CERTIFICATE(S) TO SUBSCRIBERS AND NEITHER ENTRUST NOR ANY ANY INDEPENDENT THIRD-PARTY REGISTRATION AUTHORITIES OPERATING UNDER AN ENTRUST CERTIFICATION AUTHORITY, NOR ANY RESELLERS, CO-MARKETERS, OR ANY SUBCONTRACTORS, DISTRIBUTORS, AGENTS, SUPPLIERS, EMPLOYEES, OR DIRECTORS OF ANY OF THE FOREGOING WOULD PROVIDE SERVICES IN RESPECT TO CERTIFICATE SERVICES AND THAT THESE PROVISIONS PROVIDE FOR A REASONABLE ALLOCATION OF RISK. 9. Term This Agreement will continue for the Subscription Term, however, it will terminate if You, Your Affiliates, or Your Agents fail to comply with any of the material terms or conditions of this Agreement (including for the avoidance of any doubt, the CPS and in the case of EV SSL Certificates and EV Code Signing Certificate(s), the EV Guidelines). Enterprise will immediately cease to use the Certificate Services upon the earlier of (a) expiration of the Subscription Term; or (b) upon a breach of this Agreement (including the CPS) by either You, Your Affiliates or Your Agents. Entrust may also terminate this Agreement in its discretion with notice to You in order to comply with any third party licensing or other contractual or legal obligation to which Entrust is subject. This Agreement will terminate upon expiration of the Subscription Term or revocation by Entrust of all Certificates issued hereunder if such revocation occurs prior to the end of the Subscription Term. You must, upon such expiration cease all use of Your Certificate Services and remove any Certificates issued under this Agreement from the devices and/or software in which it has been installed. The provisions entitled Representations, Warranties And Additional Obligations, Confidentiality, Intellectual Property Ownership, Disclaimer of Warranties, Limitation of Liability, Term, Severability, Audit Right, Third Party Beneficiaries, Entire

11 Agreement, and those provisions of the CPS that are designated as surviving termination will continue in force even after any termination or expiration of this Agreement. All payment obligations will survive termination. 10. Severability Whenever possible, each provision of this Agreement, the CPS, any other agreements will be interpreted in such manner as to be effective and valid under applicable law. If the application of any provision of this Agreement, the CPS, any other agreements or any portion thereof to any particular facts or circumstances will be held to be invalid or unenforceable by an arbitrator or court of competent jurisdiction, then (i) the validity and enforceability of such provision as applied to any other particular facts or circumstances and the validity of other provisions of this Agreement, the CPS, or any other agreements will not in any way be affected or impaired thereby, and (ii) such provision will be enforced to the maximum extent possible so as to effect its intent and it will be reformed without further action to the extent necessary to make such provision valid and enforceable. FOR GREATER CERTAINTY, IT IS EXPRESSLY UNDERSTOOD AND AGREED THAT EVERY PROVISION OF THIS AGREEMENT, THE CPS, AND ANY OTHER AGREEMENTS THAT DEALS WITH (I) LIMITATION OF LIABILITY OR DAMAGES, (II) DISCLAIMERS OF REPRESENTATIONS, WARRANTIES, CONDITIONS, OR LIABILITIES, OR (III) INDEMNIFICATION, IS EXPRESSLY INTENDED TO BE SEVERABLE FROM ANY OTHER PROVISIONS OF THIS AGREEMENT, THE CPS, AND ANY OTHER AGREEMENTS AND WILL BE SO INTERPRETED AND ENFORCED. 11. Third Party Databases In performing limited verification Entrust (or a subcontractor acting on behalf of Entrust (a "Subcontractor")) may determine whether the organizational identity, address, and domain name provided with Your Certificate Services Application are consistent with information contained in third-party databases (the "Databases"). Entrust or a Subcontractor may perform an investigation which may attempt to confirm Your business name, street address, mailing address, telephone number, line of business, year started, number of employees, CEO, telephone number and Your business existence. You acknowledge that some of the information submitted to obtain Certificate Services may become included in the Databases. This information will only include: business name, street address, mailing address, telephone number (outside source), line of business, year started, number of employees, CEO, telephone number and Your business existence. You acknowledge that the foregoing information as contained in the Databases may be licensed by Entrust or its Subcontractor to third parties who may offer You business products and services. 12. Use of the Entrust Secured Site-Seal Subject to the terms and conditions of this Agreement, You may use Your Certificate Services with the Entrust Secured Site-Seal; provided, however that (i) Entrust delivers to You the Entrust Secured Site-Seal together with, or in conjunction with, Your Certificate Services; and (ii) BY CLICKING THE "ACCEPT" ICON BELOW AND BY USING THE ENTRUST SECURED SITE- SEAL, YOU AGREE TO BE BOUND BY THE TERMS AND CONDITIONS OF THE ENTRUST SECURED SITE-SEAL LICENSE AGREEMENT SET FORTH AT Export Certificate Services and related information may be subject to export, import, and/or use restrictions. You will comply with all laws and regulations applicable to Your right to export, import, and/or use Certificate Services or related information, including, without limitation, all laws and regulations in respect to nuclear, chemical or biological weapons proliferation. You will be responsible for procuring all required licenses and permissions for any export, import, and/or use of Certificate Services or related information. Certain cryptographic techniques, software,

12 hardware, and firmware ( Technology ) that may be used in processing or in conjunction with Certificate Services may be subject to export, import, and/or use restrictions. You will comply with all laws and regulations applicable to a Subscriber s right to export, import, and/or use such Technology or related information. You will be responsible for procuring all required licenses and permissions for any export, import, and/or use of such Technology or related information. 14. Third Party Beneficiaries You expressly acknowledge that each Application Software Vendor and each member of the Entrust Group are express third party beneficiaries, and may enforce this Agreement and the CPS against Enterprise and rely on all terms of this Agreement and the CPS. 15. Audit Right You shall keep reasonable records relating to (i) the number of copies of Certificates deployed by Enterprise; and (ii) the number of servers which make use of such Certificates. A chartered or certified public accountant selected by Entrust may, upon reasonable notice and during normal business hours, but no more often than once a year, inspect Your records to ensure that You are complying with Your obligations hereunder. 16. Governing Law The laws of the Province of Ontario, Canada, excluding its conflict of laws rules, shall govern the construction, validity, interpretation, enforceability and performance of the Agreement. The application of the United Nations Convention on Contracts for the International Sale of Goods to the Agreement is expressly excluded. Any dispute arising out of or in respect to the Agreement shall be brought in the provincial or federal courts sitting in Ottawa, Ontario, and each party hereby agrees that such courts shall have personal and exclusive jurisdiction over such disputes. In the event that any matter is brought in a provincial or federal court each party waives any right that such party may have to a jury trial. 17. Language The parties hereby confirm that they have requested that this Agreement and all elated documents be drafted in English. Les parties ont exigé que le présent contrat et tous les documents connexes soient rédigés en anglais. 18. Entire Agreement This Agreement (including the CPS) shall constitute the entire agreement between the parties hereto in respect of the subject matter of this Agreement and all previous correspondence, understandings, proposals and other communications shall be completely superseded by the terms hereof. Any purchase order terms included or associated with any order will be of no force or effect except for the identification and quantity of the Certificate Services that are being subscribed for. Any software included in the order is distributed under the terms of the agreement that accompanies such software.

13 Exhibit A Certificate(s) Requestor(s): Certificate(s) Approver(s): Contract Signer: Web Hosters: Technical contacts: